We are setting up AD integration for SSH accounts on ESX 3.5 U3.

esxcfg-auth --enablead works just fine:
esxcfg-auth --enablead --addomain=our.domain.com --addc=our.domain.com

For some reason there was already an extra line in the configuration script: esxcfg-auth --enablekrb5
esxcfg-auth --enablekrb5 --krb5realm=our.domain.com --krb5kdc=our.domain.com --krb5adminserver=our.domain.com

As soon as this last command is entered things go wrong.
When adding a local account with this powershell command, we get this error:

New-VMHostAccount : 5/12/2009 10:17:11 AM New-VMHostAccount 52976ebb-2d24
-f493-9aa3-bca7894ef581 A general system error occurred: passwd: Authenticat
ion token manipulation error

The local account is actually created, but the Active Directory equivalent gets locked out, after several of these events:

Pre-authentication failed
User Name: TEST-USER
User ID: DOMAIN\TEST-USER
Service Name: kadmin/changepw
Pre-Authentication Type: 0x0
Failure Code: 0x19
Client Address: 10.10.120.16

Now I have two questions for you:
1. Does any one how to solve the lock-out problem
2. Is --enablekrb5 necessary? What does it gives me extra besides the --enablead

Thanks for your help!

Regards,

Harold